Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    65s
  • max time network
    110s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    11/12/2023, 03:44

General

  • Target

    0x000a000000014adb-116.exe

  • Size

    37KB

  • MD5

    f4b15e6c814a0d6abf6325753b6d4037

  • SHA1

    489d628694d794492df545d8c73cb0f910a0b479

  • SHA256

    c45b7fe3ddcf8c055c2a9ef8e5d7dabd81e73df49efb9b3a471ec4a969fbfcc3

  • SHA512

    e6c76c630de0e4b4d664b5ad7c3c24ae06d65c3aeaf4835a35406ff7e90b4ecead8cf1b3581c794d1f3870f2d472ff9f7d18c7285302fefad98042312c5d12d1

  • SSDEEP

    768:d8n3N4JRqwg8UTB+8zx70f0PSuopLwlFFWO7:dmN4JRrg8ypxSKFFX

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://81.19.131.34/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

LiveTraffic

C2

77.105.132.87:6731

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x000a000000014adb-116.exe
    "C:\Users\Admin\AppData\Local\Temp\0x000a000000014adb-116.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1764
  • C:\Users\Admin\AppData\Local\Temp\758D.exe
    C:\Users\Admin\AppData\Local\Temp\758D.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1692
  • C:\Users\Admin\AppData\Local\Temp\E73.exe
    C:\Users\Admin\AppData\Local\Temp\E73.exe
    1⤵
    • Executes dropped EXE
    PID:2428
    • C:\Users\Admin\AppData\Local\Temp\tuc3.exe
      "C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
      2⤵
        PID:2408
        • C:\Users\Admin\AppData\Local\Temp\is-6247P.tmp\tuc3.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-6247P.tmp\tuc3.tmp" /SL5="$5014C,8423542,54272,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
          3⤵
            PID:1728
        • C:\Users\Admin\AppData\Local\Temp\latestX.exe
          "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
          2⤵
            PID:1476
          • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
            "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
            2⤵
              PID:2980
              • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
                3⤵
                  PID:3024
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                    4⤵
                      PID:1596
                    • C:\Windows\rss\csrss.exe
                      C:\Windows\rss\csrss.exe
                      4⤵
                        PID:2228
                        • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                          "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                          5⤵
                            PID:2180
                          • C:\Windows\system32\schtasks.exe
                            schtasks /delete /tn ScheduledUpdate /f
                            5⤵
                              PID:3036
                            • C:\Windows\system32\schtasks.exe
                              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                              5⤵
                              • Creates scheduled task(s)
                              PID:2448
                            • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                              C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                              5⤵
                                PID:1240
                        • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
                          "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
                          2⤵
                            PID:1456
                            • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
                              "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
                              3⤵
                                PID:1672
                            • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
                              "C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"
                              2⤵
                                PID:2792
                            • C:\Users\Admin\AppData\Local\Temp\Broom.exe
                              C:\Users\Admin\AppData\Local\Temp\Broom.exe
                              1⤵
                                PID:580
                              • C:\Users\Admin\AppData\Local\Temp\11CE.exe
                                C:\Users\Admin\AppData\Local\Temp\11CE.exe
                                1⤵
                                  PID:2124
                                • C:\Windows\system32\makecab.exe
                                  "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231211034547.log C:\Windows\Logs\CBS\CbsPersist_20231211034547.cab
                                  1⤵
                                    PID:2264
                                  • C:\Windows\system32\netsh.exe
                                    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                    1⤵
                                    • Modifies Windows Firewall
                                    PID:1604
                                  • C:\Users\Admin\AppData\Local\Temp\6413.exe
                                    C:\Users\Admin\AppData\Local\Temp\6413.exe
                                    1⤵
                                      PID:1124

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                                      Filesize

                                      65KB

                                      MD5

                                      ac05d27423a85adc1622c714f2cb6184

                                      SHA1

                                      b0fe2b1abddb97837ea0195be70ab2ff14d43198

                                      SHA256

                                      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                                      SHA512

                                      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                                    • C:\Users\Admin\AppData\Local\Temp\11CE.exe

                                      Filesize

                                      219KB

                                      MD5

                                      91d23595c11c7ee4424b6267aabf3600

                                      SHA1

                                      ef161bb8e90cebdf81f4e53dfccb50c1f90a9a02

                                      SHA256

                                      d58937d468f6ca92b12ee903a16a4908de340f64f894cf7f1c594cd15c0c7e47

                                      SHA512

                                      cb9ed75c14e7b093cabab66c22d412371c639ace31fbe976c71ffec6007bf85b3d7d3e591fe5612e2a035298398d32e1aa7dc0d753f93328ebc2ce8e44fb8d2b

                                    • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                      Filesize

                                      478KB

                                      MD5

                                      8588beacdc0bc0786a1d3ad0994a4ad2

                                      SHA1

                                      77559a274101be1f5ce01dd6837c5adbe7b28edf

                                      SHA256

                                      44a9cd69817b8b162ce5c976ddf0b1d6c147ddcce90475612c4699c965a3aaa2

                                      SHA512

                                      301bca1698920a4000eef553f9a7cf18698284463f178234f4c2962fb9ecde515ad0e508b0be7f68b884da3079be7334ffc69c1a7fd782e8c3a135b7b2f5607b

                                    • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                      Filesize

                                      32KB

                                      MD5

                                      1b34ee464944864d44f1f8bbb3dad7fa

                                      SHA1

                                      5768fe663d155465b3ee07e514dcf6a9d04238fe

                                      SHA256

                                      3a09158cf77af5ca18efa7960a35f90bf52564d458a7f65c656db6a6cc3e6323

                                      SHA512

                                      df69ceb08767681e3a36d64b69a98dfb9f20e6b88294861db5208bf586c209af82bdbd0d5feae0b34df7ab20f412cee947901e621181324289ed0234131974cf

                                    • C:\Users\Admin\AppData\Local\Temp\6413.exe

                                      Filesize

                                      103KB

                                      MD5

                                      f4b4639ac5878c04baa77a1a01b251aa

                                      SHA1

                                      95c9a5bce180433288619fb0890e6787ad98feb1

                                      SHA256

                                      f8eb6e988c65ce9b870a092c71729ff94f91e8a3aeb3fbdbbc510bda2383032d

                                      SHA512

                                      03f669ce80b61d4eea57f2aaf4d09263357ab1e4d93effa0bb318227376c39633ed84cb6fd35ccf3097fc7b0971f5adddb0fb043b41bdb8940a8feae4443441f

                                    • C:\Users\Admin\AppData\Local\Temp\758D.exe

                                      Filesize

                                      401KB

                                      MD5

                                      f88edad62a7789c2c5d8047133da5fa7

                                      SHA1

                                      41b1f056cdda764a1c7c402c6fa4f8ab2f3ce5f9

                                      SHA256

                                      eb2b1ce5574096b91eb9e0482117d2518ab188c0747a209dc77e88d30bb970dc

                                      SHA512

                                      e2d5b0ace5dfd3bd2321b2a42b7e7725071ca440389dc5ef12720a34727ae84c2907cd7befeae5d53568d9deaee8443f4cbda44b598cfc9b6316d9389be09a60

                                    • C:\Users\Admin\AppData\Local\Temp\Broom.exe

                                      Filesize

                                      122KB

                                      MD5

                                      5278019a2e3d029bc25104a3aee4b07c

                                      SHA1

                                      c5cd7c0e2dc4b349398158c5c254feabe608c73b

                                      SHA256

                                      e700b779af26dd375ebcd916ea6c4d1a1acaac66e39f32a666a93a2934841b32

                                      SHA512

                                      d5f4ef89b2bae07182981622bada4c1ac54cd369047616311002355e6a59aceed1dc555ef0020383bc7a7984a506b211414c7c88b0147aa84b1bd15494a7bc78

                                    • C:\Users\Admin\AppData\Local\Temp\E73.exe

                                      Filesize

                                      1024KB

                                      MD5

                                      4146a78eb916ea0c61c38265739214ab

                                      SHA1

                                      f12c4ff52f909f5e9e434d67a5edf22fe143882f

                                      SHA256

                                      a44b6b0ae1ed6aa2665300e8e752607b3d50211d0461c8304d2ffe74336045e2

                                      SHA512

                                      1515ee4be391e7062ff8d029279ef9435f2afda858d27f5ddc0ca0466a849982e3a4b5815a5af89e5ff7f8788aac0ea435de9bf081f682a78726a097ede39848

                                    • C:\Users\Admin\AppData\Local\Temp\E73.exe

                                      Filesize

                                      1.2MB

                                      MD5

                                      5eaf2409ecc3a1efe6c706565a1894ba

                                      SHA1

                                      8fa8c99cbda0cc0ba261a60524669878bda719aa

                                      SHA256

                                      81678dbe86474f0d18e6067dea3f3df940d26fa14ddd866302e4e5fee3c8f208

                                      SHA512

                                      6fe2a15259efa052d4181bc76d8a29a4687a3b5e20326c8a6a075ef741d46a456ce95d3ff0c7f8598e4b410467282a799b8daefc78f7257686fcb90b580276d4

                                    • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

                                      Filesize

                                      815KB

                                      MD5

                                      487d5bdf95b8ffb0c0378b893cd0d95f

                                      SHA1

                                      1e5759dbb529f9894d2223089687299c8b05dd2a

                                      SHA256

                                      8a2289132350feccc233cb83a7f30fc9324824c3c3d4b2e13b810ff4958af282

                                      SHA512

                                      b91f72b1a1aba03cd55fb26d969a1a827478102c0c0b30206ce6f0052e21a7a67e220e83ca94d655ab3731c34e1a1b972f42a9a4fad6e515897919eb2548e931

                                    • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

                                      Filesize

                                      96KB

                                      MD5

                                      79c77dfe61fbc798fbafb5eab8928e32

                                      SHA1

                                      ff40586f6296857bd40a1f729c86d3ca89c432b5

                                      SHA256

                                      6c026548352de4b0a92869f3a78c2562c1aafb0016b52beb7deddf63413de47f

                                      SHA512

                                      d0f6eb8fd57cf174e6a77a88ff6ad13d89c747bcd919564e5f062a9cb36f4ca68129872b13f553264b14528136b0ca80405e9c02125097597652ccd272ceac66

                                    • C:\Users\Admin\AppData\Local\Temp\Tar4FAB.tmp

                                      Filesize

                                      80KB

                                      MD5

                                      e94892d1d0a3dbd45bc750612eb12cb7

                                      SHA1

                                      5a7396945e8f41947c9d44e77d3e3620c6ae3240

                                      SHA256

                                      d418b0df7ef0bcdfd185597f80a2be0caa86a694d4710efcc690d6f3d60198dc

                                      SHA512

                                      864d0a39a83d107d41f05911d1c982534c07a410fc51c2e2d30d70bdf4af37fa0feb99974bf521e17c3731bf5153c0bfed7b4839044e608977f2b05afe038b98

                                    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                                      Filesize

                                      127KB

                                      MD5

                                      a77eee726b4a5dd57b1e98047a48d767

                                      SHA1

                                      4705d07e29e4739ca96910a9a25023ac076a5253

                                      SHA256

                                      e64d046f70479805495430aed469bc6ac52dc2d78ec987a83752cc05b03b434a

                                      SHA512

                                      95d9da5796be8e30420aba2306fd1fc0901c61bfa33e7d14cf84643bb359fde0b9d9fa2de0db9fe09700f7125783b2f973f06fad3fb7560820dd160e83f9a617

                                    • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe

                                      Filesize

                                      169KB

                                      MD5

                                      a2b9747ca60956fdf08c0ab28b66c503

                                      SHA1

                                      a8a9947cc350df80cf4861d72c650bb326445fb6

                                      SHA256

                                      88fdde3787cee8c2ce7bb3c3191b367adfac2d42b5e48bda79e77d304b38fb2a

                                      SHA512

                                      5601aee99b160782966f3d662a53125df46ddaf9660214a73d91a8da324572571ee398f3499538e3c58c05be8f914f49c3671d4c8a6527ad21df71329cbd37f9

                                    • C:\Users\Admin\AppData\Local\Temp\is-6247P.tmp\tuc3.tmp

                                      Filesize

                                      108KB

                                      MD5

                                      928370c987e89a5eb23a8c3386d919a7

                                      SHA1

                                      0ce170a6c1b7daa3f4243c0c1b89b13bb6a71c9d

                                      SHA256

                                      32ed20ce4c4529a46b6a8080cea950b792558983e563edf57d0aa4175fe0315d

                                      SHA512

                                      bd8642f2c8d37d385ecd1517f6ba388216d18feaaf07a4cce3c83518dd46acf6a42e4f4f9132b65daba34737ffc5cbd71bfce89e56d477d933316e886c87b6d4

                                    • C:\Users\Admin\AppData\Local\Temp\latestX.exe

                                      Filesize

                                      102KB

                                      MD5

                                      3c8249815a08ec24e7006198f9a48347

                                      SHA1

                                      a71b7d02ab195978db564260d852109700741287

                                      SHA256

                                      b300df30f37fa8a53062107ce1aeb7d6e5f1e906f138cc097fdcb30ff7c85515

                                      SHA512

                                      b1f3a8760d6c477c8ac398636785fa4a1d3e62d3c9ec7e68679ced5aabb3de09be5937cb7d8e54623ab5494b7ba7b77d44ce24f85919715089e1121836d17d71

                                    • C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

                                      Filesize

                                      169KB

                                      MD5

                                      83642a68dcf026439852bd86edaf0e4b

                                      SHA1

                                      86ed270e00f9e08eef57b1437f78b89ffe638f07

                                      SHA256

                                      575a2db41823058d55b1c68d7d09c00016c6185efb2282bb9fbdb7104be4e8e8

                                      SHA512

                                      9f64d149dcac96f38232bdbf5830cac2ab0c0e46ef240f85c65cbd3596b1da383906e369e13616a8228293d736fb0ab7b9ffd2a6cb27f6861a7955a79d5933bf

                                    • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                      Filesize

                                      125KB

                                      MD5

                                      fb8189a15cb02889097ed80f3152d9e7

                                      SHA1

                                      2db947a0cdd9306995c7041f39b4329f34f6b69e

                                      SHA256

                                      db4c7d97900e6e6d8705a95db68f1ed1f2ce851044ca85e437b9dd936dd6400b

                                      SHA512

                                      76575a7a17c74246107af4289511f28898cc2a9a3c2ca05de476a03d0962f0f1de71c80bc2339027eaca3399c78016f2a90e97fee4abc393d68496fe6b20799c

                                    • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                      Filesize

                                      63KB

                                      MD5

                                      068d86f561df385692269564509fecf4

                                      SHA1

                                      756afaaa86dd9df9b6161baf59f02582ba8e18b9

                                      SHA256

                                      d7cc49ca41d7fe6c47bee8aabff6223634e040d0aa1137dac3fae19ba546a0ba

                                      SHA512

                                      224c0618702d31247dea785b63d2c9ba8837468feab942c90b73df529e4e71b47f48bc578f3bdea62d1872a0ac7db52c718016df7863039fc365ff10c42dac88

                                    • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                      Filesize

                                      291KB

                                      MD5

                                      cde750f39f58f1ec80ef41ce2f4f1db9

                                      SHA1

                                      942ea40349b0e5af7583fd34f4d913398a9c3b96

                                      SHA256

                                      0a434be25f55f27ce0adbdfb08efeac1da01125b3e9194a94669bc7e9c6fe094

                                      SHA512

                                      c181faacbef70f8a91606943470af50cfd443958c48601051371ff5d9bf66bb9ec794571b05a347a7f5776f06484dc007f535591d2f5e1c57e3c0ee04f3e9580

                                    • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                      Filesize

                                      193KB

                                      MD5

                                      536adf4ebcc947a0eaf22ff58693b141

                                      SHA1

                                      1c095921352e2a70cf16790ef943cdb528d315d5

                                      SHA256

                                      9b2b660e59412c762ebc0ed88311cee8bb5d12d65436cdeccd21db9cf6120711

                                      SHA512

                                      976f925bcbd4cd7e45c27d2182433de82d47e330ebe6e12b9a4f5fc2702fa22a995fccc264855a5482fb50395ca89b659c027d5c5b016d151428e25aef641b81

                                    • C:\Users\Admin\AppData\Local\Temp\tuc3.exe

                                      Filesize

                                      168KB

                                      MD5

                                      251b829c26d72951c9adcb39d9f7b141

                                      SHA1

                                      33e7a6c9488e52638a61f279c4adf01ed2df04ac

                                      SHA256

                                      cf8c8febe97e6db228cfc9a961cfd1eecce63b30deea0d05e331f74762bd36c1

                                      SHA512

                                      2234f03900e6153b4aeae8a17cd266112ef466b8e993027d64588d807e8fc2898d91aeab3a936f6f7ac7de53edee22bb7fde1b1ee7123226063d0a3f063ad725

                                    • C:\Users\Admin\AppData\Local\Temp\tuc3.exe

                                      Filesize

                                      254KB

                                      MD5

                                      aae2bb9649db8b6857e77a91fbb88b6a

                                      SHA1

                                      b33f7aa7103853e221e594149930f615b2afeeb1

                                      SHA256

                                      38f91c4ce042f477cdda3367a47e040cd0e44f28691a8adc46881e662e93fbf6

                                      SHA512

                                      fcc75a4f88484eb39991d0697be5df709ce935b4029f04fb9d4d9eceab57bf33a2755794deef26d8c134b8519aafada296c62211302c81405e9ec3565491cb80

                                    • C:\Windows\rss\csrss.exe

                                      Filesize

                                      7KB

                                      MD5

                                      f7796c52f010baf347a59605af046537

                                      SHA1

                                      d28390de5f331b848b832dd6580f7c4b99a7cdf8

                                      SHA256

                                      1145e83202f25eb5c16f08a5cf6d402cd11d5f57f9d825f99fad32f556248bbe

                                      SHA512

                                      322c8ca6125622d5b9d8b5f1d78548c55de9a9d019209d90cff65ebcf92d0e99a67da38fd7274416b4c5e1f2a8d8ac8e8dfa00181848afc4b8bbfd2d85acf0e3

                                    • C:\Windows\rss\csrss.exe

                                      Filesize

                                      243KB

                                      MD5

                                      82efb958c282968e55810ebb2281e7d1

                                      SHA1

                                      f1bf6b280c70b3d1d851bcef1231cacc57a5cb6c

                                      SHA256

                                      0c01e91a326eec2fb56fb63b4b066f7f7c8e0594313443afdfc20519c9c4c1b3

                                      SHA512

                                      6ffed1126f91695ad0e324a38980022e3d5cdad348d2e040e9bfca430f72e05fdb0b2aba5a155263aa6e1d332928d9b1a6068c1c101f034097849b900980d051

                                    • \Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                      Filesize

                                      536KB

                                      MD5

                                      449bfe662be8c42408b804baaea5b8ee

                                      SHA1

                                      149d512869fcec22e8d69c1b87c689c02a5aeb69

                                      SHA256

                                      f0d56b26011f3606066f6db4dbb921b9d89751e9489d148374601a4da928ca3b

                                      SHA512

                                      f86d34a614df59f3212b903dce7997873727a2fcb03cbd3c8a1ce97eb4f0961b672149879b7ce2ed9cf2a38574b497b4b628d4c25fcce69073e50ec2dbeb8830

                                    • \Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                      Filesize

                                      373KB

                                      MD5

                                      51cf023b81c8e9ba2dca2c7010b02c32

                                      SHA1

                                      a0eacb314740ed74cb7629524713efcba167ebf4

                                      SHA256

                                      605e6ca91845d3b6cf008cd554d4727d03ab33c2851d89644f55bf6aaf88f05f

                                      SHA512

                                      0425fc294878c67623504e9374ed08a539b7edcb629b3eb4e103a992ae499aeb442a89f4eb7d9832fda6362ab5246f6b92e7fb1c4a6c4c94e17458d80c93fae7

                                    • \Users\Admin\AppData\Local\Temp\Broom.exe

                                      Filesize

                                      192KB

                                      MD5

                                      c90476810d098eeecd16bfbfd42faaed

                                      SHA1

                                      e0a202694a94d50dc133bf5eb61909d4c617ddc8

                                      SHA256

                                      e3445f06a53bea1272a37b112d0e854739c3a49327b595ac06cfbb5b864b71b6

                                      SHA512

                                      af4edd3301115e16a576453ed717262afa670860a9d7e45281a09081e11dbdad378a90815ae410e758225f84adaf9a8c33e6911d0e85cc33be5f30868f130d37

                                    • \Users\Admin\AppData\Local\Temp\InstallSetup9.exe

                                      Filesize

                                      155KB

                                      MD5

                                      29e818d29c59539fc36290a24fdcb728

                                      SHA1

                                      7a01cdaab7392fe30bf7dd186b6a60f5e9d93f58

                                      SHA256

                                      cec0ab5fc20a1b55a7b90f0bdcb3a1fcbb21ea808fed3091919fbcbec7df4584

                                      SHA512

                                      7e6f671dd77fd050bfd006cfcecd6b42b1531235adcc2c998413df7a797ee3df4bc503e7814df4fc187c93980a5f4a6aec4aed014e1ec12f09423d561a4e364f

                                    • \Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                                      Filesize

                                      86KB

                                      MD5

                                      aba550112e102b6a9de865ab096aea92

                                      SHA1

                                      dbf19c87af24a28cf9bfbb0fdcd3b86124ef8a93

                                      SHA256

                                      70d9ae706529793799cefeb42fbee8e9f553e75705deec4ebe794799d9c6ece8

                                      SHA512

                                      a501d1a419f56dbd8a3f54aa669805cfebd40b0eff0cd35a5ed57b8edc6df2ef1c3c47c275008c15af78cca51b55849303d03e18469d6d1fe65e584f12f2333e

                                    • \Users\Admin\AppData\Local\Temp\csrss\patch.exe

                                      Filesize

                                      166KB

                                      MD5

                                      6e350c613742cd4f1057cc64ee60ea67

                                      SHA1

                                      236939f833a84ebb4e93c23712d571fe146d4812

                                      SHA256

                                      6a59db3a1d29bb965b29cdda56349c74d9621a3ff2b257f6ee014374603f8597

                                      SHA512

                                      4cbb9054e8669d4b1049aabd48da380d04455b6ef76b63870541c87043d7e817b06ef8cc67ed8dac0f73854ed831640fdcf44a0a1b2e22a105fc92bc2bbc884f

                                    • \Users\Admin\AppData\Local\Temp\dbghelp.dll

                                      Filesize

                                      181KB

                                      MD5

                                      4dff12f40697f125fd6b5b6e99c6a115

                                      SHA1

                                      3fdf96045c610796004ef5207a0a8966884030fc

                                      SHA256

                                      e5ff24b6bf9810c1d43dafc3861f1d269d2122d1da9e92c26e54e56844aba90c

                                      SHA512

                                      8c92f6be4603be7f202f46f4b15e115fe1b20e93c79603158ce6904c6e753808f339d28993859da56db98f05da47c8a9abf2aa49e53fc47125d1634292f687ac

                                    • \Users\Admin\AppData\Local\Temp\is-6247P.tmp\tuc3.tmp

                                      Filesize

                                      64KB

                                      MD5

                                      ddc7c8c73b4a7e7b4e0e7abc68082c5e

                                      SHA1

                                      8dccafdd98d0bc7572845226eaf818c5d87d6114

                                      SHA256

                                      d590d4f4dc932a97c6ff81f28e708382d692ca9696b048b5bdf7fc1cfce460cf

                                      SHA512

                                      abdfa6d2456be7771308ee02748269cab351124b1a944877831dd8f1f74ee51bbc9206f5aba0fe4bb86d3cf5ef04faa980af5b57e1d43f92de567e1e473e5040

                                    • \Users\Admin\AppData\Local\Temp\latestX.exe

                                      Filesize

                                      89KB

                                      MD5

                                      dfe8bd49730937e33a0e4c6158ce95a5

                                      SHA1

                                      4c1fffa73578d159e57e6a75ffdd424d63d74463

                                      SHA256

                                      e45bdb954a233ecd0fe6089e68caa32c49506e6a9831b7528667a7e8b6177c72

                                      SHA512

                                      aba42c151b986cfde3f5660c4fe323cfaa4fde6862f162817bd44603531973a8a82bd85cd664553fd573ae42e3b433aac236ad10e5276434d96dbeb8aff98600

                                    • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

                                      Filesize

                                      107KB

                                      MD5

                                      016f94d053e2a0af8b2fd565d098fd33

                                      SHA1

                                      3da0639be1b677cf1d432f39f430e706c76a90b3

                                      SHA256

                                      882ddb96f7f500fe8066ec841a14e9e50f70fbc7fd0b94b463b00e31fea66fb6

                                      SHA512

                                      4f66de64b2b6ff043c882008a8bef8f610288faaa73b07923fd323d80bdb0b3eade433b5842ab6c4163257e65ad308d59f29a5e6537c2e8dd02ee08ef7b46189

                                    • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

                                      Filesize

                                      202KB

                                      MD5

                                      036232a44b04f8d5cea3b1c6955d0979

                                      SHA1

                                      a0f12185669ea7a2f8963034f7fe86d7ceb92e4f

                                      SHA256

                                      0f5b8e69c224010bf358e411432706393abf1a4af6d527f3733d1f28fb8cf3d2

                                      SHA512

                                      bd3261aece57c1c9aa050af1c8078a682dcda3fe153ad1ecd575c96ffe38ce6adcccfe9f2dad77f0fd412aa19715ca5738133740f8a1eedfcde1f3dc0d0cca31

                                    • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

                                      Filesize

                                      156KB

                                      MD5

                                      829be5d774062ab9406f3c67a6e866e5

                                      SHA1

                                      6be024587b113490181406219a7aaf5f8ea4cd32

                                      SHA256

                                      32aa224c4510ab359ca0c574a6d867deb5dfd4ee1028f3077bb3795f14d90f86

                                      SHA512

                                      49bb7653c7592887e9ccff4d20288490fefaf24f49b631e70d69ba09bb07893c17d56ad140737b5077376c74252e0bf13c4ddafa32cc417961a8a76bfe602eb5

                                    • \Users\Admin\AppData\Local\Temp\symsrv.dll

                                      Filesize

                                      163KB

                                      MD5

                                      5c399d34d8dc01741269ff1f1aca7554

                                      SHA1

                                      e0ceed500d3cef5558f3f55d33ba9c3a709e8f55

                                      SHA256

                                      e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f

                                      SHA512

                                      8ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d

                                    • \Users\Admin\AppData\Local\Temp\toolspub2.exe

                                      Filesize

                                      30KB

                                      MD5

                                      180b9d3bed06fa2f7cae713f2c2c7706

                                      SHA1

                                      c2c3030a6a97e0e4f99a9b2afd16f4dc143ce106

                                      SHA256

                                      452526283878a997b81b0380b5fb45b07ae74676d9c56c7a68257fa9f18c1fdc

                                      SHA512

                                      9f32dd7bf147b22f3229177dd7b704fa55e2c7a3790cbfead84472d35bd4fbe0e4f91e26c8a1f7a91d87b3d0923a22776a5b0dcdcc99066d58b25a5eee6afeb8

                                    • \Windows\rss\csrss.exe

                                      Filesize

                                      89KB

                                      MD5

                                      d97a6bf268bac64c843406c8351ef85e

                                      SHA1

                                      29f9f2e5dfea9e372ab0a5f65d49ec7693d23538

                                      SHA256

                                      7054e8c5b7cada9ae033994b3e1e14fc355198b1a0ae07af7b70e2fab4565e81

                                      SHA512

                                      477e787ff95e55b0e767c365c1fdda40d938a8e713a98edb1a1cb2cc8651872696502f7cb160df0ced2687a53ae25c033f7812f367ffbc91c24ad15df23f0e58

                                    • \Windows\rss\csrss.exe

                                      Filesize

                                      84KB

                                      MD5

                                      474410844f8e50d312878d7a126130ab

                                      SHA1

                                      5701669297693449b1935801fcb444d95fb659a1

                                      SHA256

                                      ff762dbe25763ddbcf5e9448bdcec89274466815703a69464cdfbb6d28763ea4

                                      SHA512

                                      b56d5e8ea766ed000df220b98b9a5e5fc2d918877736e2df5c2f01c249048e1062d57e9dd2de09d15025eddb6fc6e338b4ddc96402bc86a491d5cea20d17e239

                                    • memory/580-162-0x0000000000230000-0x0000000000231000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/580-188-0x0000000000400000-0x0000000000965000-memory.dmp

                                      Filesize

                                      5.4MB

                                    • memory/580-113-0x0000000000230000-0x0000000000231000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1124-250-0x0000000074470000-0x0000000074B5E000-memory.dmp

                                      Filesize

                                      6.9MB

                                    • memory/1124-251-0x00000000053D0000-0x0000000005410000-memory.dmp

                                      Filesize

                                      256KB

                                    • memory/1124-247-0x0000000000BE0000-0x0000000001192000-memory.dmp

                                      Filesize

                                      5.7MB

                                    • memory/1360-146-0x0000000003030000-0x0000000003046000-memory.dmp

                                      Filesize

                                      88KB

                                    • memory/1360-1-0x00000000025A0000-0x00000000025B6000-memory.dmp

                                      Filesize

                                      88KB

                                    • memory/1456-120-0x00000000001B0000-0x00000000001B9000-memory.dmp

                                      Filesize

                                      36KB

                                    • memory/1456-125-0x00000000002D2000-0x00000000002E5000-memory.dmp

                                      Filesize

                                      76KB

                                    • memory/1476-187-0x000000013F860000-0x000000013FE01000-memory.dmp

                                      Filesize

                                      5.6MB

                                    • memory/1672-126-0x0000000000400000-0x0000000000409000-memory.dmp

                                      Filesize

                                      36KB

                                    • memory/1672-147-0x0000000000400000-0x0000000000409000-memory.dmp

                                      Filesize

                                      36KB

                                    • memory/1672-121-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1672-123-0x0000000000400000-0x0000000000409000-memory.dmp

                                      Filesize

                                      36KB

                                    • memory/1692-12-0x0000000000150000-0x000000000018C000-memory.dmp

                                      Filesize

                                      240KB

                                    • memory/1692-17-0x00000000744A0000-0x0000000074B8E000-memory.dmp

                                      Filesize

                                      6.9MB

                                    • memory/1692-18-0x00000000076A0000-0x00000000076E0000-memory.dmp

                                      Filesize

                                      256KB

                                    • memory/1692-22-0x00000000744A0000-0x0000000074B8E000-memory.dmp

                                      Filesize

                                      6.9MB

                                    • memory/1728-186-0x0000000000400000-0x00000000004BD000-memory.dmp

                                      Filesize

                                      756KB

                                    • memory/1728-102-0x0000000000240000-0x0000000000241000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1764-0-0x0000000000400000-0x000000000040B000-memory.dmp

                                      Filesize

                                      44KB

                                    • memory/1764-2-0x0000000000400000-0x000000000040B000-memory.dmp

                                      Filesize

                                      44KB

                                    • memory/2124-152-0x0000000074470000-0x0000000074B5E000-memory.dmp

                                      Filesize

                                      6.9MB

                                    • memory/2124-73-0x0000000000130000-0x000000000016C000-memory.dmp

                                      Filesize

                                      240KB

                                    • memory/2124-86-0x0000000007250000-0x0000000007290000-memory.dmp

                                      Filesize

                                      256KB

                                    • memory/2124-74-0x0000000074470000-0x0000000074B5E000-memory.dmp

                                      Filesize

                                      6.9MB

                                    • memory/2180-177-0x0000000140000000-0x00000001405E8000-memory.dmp

                                      Filesize

                                      5.9MB

                                    • memory/2180-169-0x0000000140000000-0x00000001405E8000-memory.dmp

                                      Filesize

                                      5.9MB

                                    • memory/2228-154-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                    • memory/2228-239-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                    • memory/2228-153-0x0000000002730000-0x0000000002B28000-memory.dmp

                                      Filesize

                                      4.0MB

                                    • memory/2228-151-0x0000000002730000-0x0000000002B28000-memory.dmp

                                      Filesize

                                      4.0MB

                                    • memory/2228-253-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                    • memory/2228-252-0x0000000002730000-0x0000000002B28000-memory.dmp

                                      Filesize

                                      4.0MB

                                    • memory/2408-62-0x0000000000400000-0x0000000000414000-memory.dmp

                                      Filesize

                                      80KB

                                    • memory/2408-135-0x0000000000400000-0x0000000000414000-memory.dmp

                                      Filesize

                                      80KB

                                    • memory/2428-29-0x0000000000E30000-0x00000000022E6000-memory.dmp

                                      Filesize

                                      20.7MB

                                    • memory/2428-28-0x0000000074470000-0x0000000074B5E000-memory.dmp

                                      Filesize

                                      6.9MB

                                    • memory/2428-81-0x0000000074470000-0x0000000074B5E000-memory.dmp

                                      Filesize

                                      6.9MB

                                    • memory/2980-130-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                    • memory/2980-131-0x0000000002C80000-0x000000000356B000-memory.dmp

                                      Filesize

                                      8.9MB

                                    • memory/2980-114-0x0000000002880000-0x0000000002C78000-memory.dmp

                                      Filesize

                                      4.0MB

                                    • memory/2980-116-0x0000000002880000-0x0000000002C78000-memory.dmp

                                      Filesize

                                      4.0MB

                                    • memory/2980-117-0x0000000002C80000-0x000000000356B000-memory.dmp

                                      Filesize

                                      8.9MB

                                    • memory/2980-127-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                    • memory/3024-133-0x0000000002640000-0x0000000002A38000-memory.dmp

                                      Filesize

                                      4.0MB

                                    • memory/3024-132-0x0000000002640000-0x0000000002A38000-memory.dmp

                                      Filesize

                                      4.0MB

                                    • memory/3024-134-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                    • memory/3024-144-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                    • memory/3024-145-0x0000000002640000-0x0000000002A38000-memory.dmp

                                      Filesize

                                      4.0MB